Graylog, headquartered in Houston, offers their eponymous platform for centralized log management that helps users find meaning in data faster so as to take action immediately. Graylog is available via Enterprise and Cloud plans, but also has a Small Business Plan, and an Open (free) plan with limited features.
N/A
PRTG
Score 8.5 out of 10
N/A
PRTG Network Monitor is the flagship offering from German software company Paessler, for monitoring local and wide area networks (LANs & WANs), servers, websites, apps, and more.
For small companies, Graylog is the best solution possible. It's easy to configure and "just works." Above everything else, it's free. The only thing I hold against it is the fact that it's Linux-based. [This] makes sense because Elasticsearch is Linux-based. But Linux adds a layer of complexity that we don't need for something basic as a logging server. I'm pretty sure that we would have had a logging server years earlier if I had to convince quite a few decision-making people to go ahead with it anyway.
If there are a number of different protocols and devices to monitor PRTG is really an all in one solution. There are network specific solutions, telephony solutions, server solutions, etc - but this tool can do anything. Even if you don't use this tool as your main "monitoring solutions" every IT professional should have access to this tool for at least troubleshooting purposes. If you are looking for something specific built for a task you may be able to find [a] more direct and easy tool to use that would be easier and quicker to setup as customization is not needed.
Graylog does a great job of its core function: log aggregation, retention, and searching.
Graylog has a very flexible configuration. The backend for storage is Elasticsearch and MongoDB is used to store the configuration. You have to option to make your configuration as simple as possible by storing everything on one box, or you can scale everything out horizontally by using a cluster of Elasticsearch nodes and MongoDB servers with several Graylog servers pointed to all the necessary nodes.
Graylog does a good job of abstracting away a fair portion of Elasticsearch index management (sharding, creation, deletion, rotation, etc).
Very, very configurable. You can create all kinds of monitors for all kinds of things. Plus it has loads of suggestions out of the box. It can get complicated but monitoring is complicated. Pretty decent interface and good support - active community.
I really liked how easy it was to add alerts by SMS. So easy to setup.
I like their sizing models (for purchase). We're actually small enough that we are free. But it's not free as in stripped down - it's free because we don't use many "sensors" and don't honestly have the need.
The probe service can be quite resource-intensive. This can cause false-positive readings from some sensors sometimes.
The software gets updated very regularly. Whilst this is usually a good thing to fix bugs etc, it does meantime downtime of the monitoring quite often while they are installed.
The ability to create Maps from Libraries. Very specific issue but a lot of people have been asking for it for years and it is still not available.
The tool is very intuitive to use and it is Windows-based (everybody knows how to use Windows) so it's easy to get into. Every time is setup in a hierarchy so if you have a good initial hierarchy design, it will really reduce administrative effort down the road.
Community support does not give simple straightforward answers; simply search up Graylog Issues and look at some of the responses on the forums. The documentation is your only hope if you are on the free version, as you can NOT purchase only support. The few times I have worked with Graylog Enterprise support they were great though.
I am giving this a 6 simply because I have never had to contact support. The online documentation is adequate for most things, and the user-maintained knowledgebase is excellent. The few times I have run into issues that were not easily resolvable with intuitive UI, I was able to find the answers that I needed either in the PRTG-provided documentation, the knowledgebase, or with a quick online web search.
In terms of log aggregation, the free product fully stacks up with the competitors listed. Full control over the data ingests for flexible configuration. Graylog even better on that front than AlienVault USM because you cannot configure the variable mapping. We haven't used the threat exchange stuff or correlation. But with regex searches, we have created function dashboards that show threat theater pictures of our network based on logs from our firewall.
I have deployed and tested three products for evaluation I found [PRTG Network Monitor] very easy to deploy, the deployment literally took not more than one hour including basic configuration and network discovery. After deployment few configuration changes and creation of maps, reports and little tweaking is required. [Then] it would go through its process of recommendation that took some time to complete, while [on] other hand other software's took lot of time to install and configure. And features were also missing, which resulted in decision in favor of [PRTG Network Monitor].
Graylog is just less expensive than some other options which meant it fit into our budget otherwise we might not be able to justify a higher cost.
Being able to track issues that we normally couldn't track using other tools is a bonus to help us know of any issues we have and can fix before an outage or failure that could potentially cost money.
We have had to spend more time than I would like to understand and customize Graylog which has taken time away from other tasks and projects.
The ability to analyze multiple pieces of information in one place, especially with historical data, has saved our IT department time and headaches. It would be so much more difficult to trace an issue without PRTG, just relying on event logs and an open task manager window.
The cost is not cheap, so it's an expense that hits the bottom line like everything else. Figure in hardware costs as well, ideally a server outside of your main environment.
I keep saying this, but the historical data piece is worth so much. There's really no good way to collect all of that information in one place without something like PRTG. And that definitely saves time and money in the long run.
